diff --git a/public/docs-static/img/how-to-guides/msp-portal/add-new-tenant-permissions.png b/public/docs-static/img/how-to-guides/msp-portal/add-new-tenant-permissions.png
index 199b3e31..5f35645f 100644
Binary files a/public/docs-static/img/how-to-guides/msp-portal/add-new-tenant-permissions.png and b/public/docs-static/img/how-to-guides/msp-portal/add-new-tenant-permissions.png differ
diff --git a/src/pages/how-to/msp-portal.mdx b/src/pages/how-to/msp-portal.mdx
index 4c65b801..bfd685fe 100644
--- a/src/pages/how-to/msp-portal.mdx
+++ b/src/pages/how-to/msp-portal.mdx
@@ -42,11 +42,14 @@ In the 'Tenants' section of your dashboard, click on the 'Add Tenant' button to
     <img src="/docs-static/img/how-to-guides/msp-portal/add-new-tenant-name-domain.png" alt="add-new-tenant-name-domain" className="imagewrapper"/>
 </p>
 
-2. Define who can access the tenant account by selecting user groups of your account. Only users from the selected groups will
+2. Define who can access the tenant account by selecting the user groups of your account and the applicable [user role](/how-to/add-users-to-your-network#manage-user-roles) when they switch to the tenant. Only users from the selected groups will
 be able to switch to and manage the tenant account.
 <p>
     <img src="/docs-static/img/how-to-guides/msp-portal/add-new-tenant-permissions.png" alt="add-new-tenant-permissions" className="imagewrapper"/>
 </p>
+<Note>
+    If a user belongs to multiple groups with different roles, the highest permission role will be applicable.
+</Note>
 
 3. To ensure that you have rights to manage the tenant, you need to verify the ownership of the tenant domain by adding
 a TXT DNS record to the tenant's domain: